=====================================================================
                                  CERT-Renater

                       Note d'Information No. 2005/VULN654
_____________________________________________________________________

DATE                      : 21/10/2005

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running xli.

======================================================================

  _______________________________________________________________________

                 Mandriva Linux Security Update Advisory
  _______________________________________________________________________

  Package name:           xli
  Advisory ID:            MDKSA-2005:192
  Date:                   October 20th, 2005

  Affected versions:	 10.2, 2006.0, Corporate 3.0,
			 Corporate Server 2.1
  ______________________________________________________________________

  Problem Description:

  Ariel Berkman discovered several buffer overflows in xloadimage,
  which are also present in xli, a command line utility for viewing
  images in X11, and could be exploited via large image titles and
  cause the execution of arbitrary code.

  The updated packages have been patched to address this issue.
  _______________________________________________________________________

  References:

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3178
  ______________________________________________________________________

  Updated Packages:

  Mandrivalinux 10.2:
  934ff40c8d59f0d113abbb0064be5392  10.2/RPMS/xli-1.17.0-8.2.102mdk.i586.rpm
  28924458550bcafd6a2432dda2fca55d  10.2/SRPMS/xli-1.17.0-8.2.102mdk.src.rpm

  Mandrivalinux 10.2/X86_64:
  59c2de1a44f737e6c50f8e238e2176e4  x86_64/10.2/RPMS/xli-1.17.0-8.2.102mdk.x86_64.rpm
  28924458550bcafd6a2432dda2fca55d  x86_64/10.2/SRPMS/xli-1.17.0-8.2.102mdk.src.rpm

  Mandrivalinux 2006.0:
  2574d65860a01e546b8c73cb852d81c5  2006.0/RPMS/xli-1.17.0-8.2.20060mdk.i586.rpm
  fc2ef038f442fd1a47f3dad7d1761b7e  2006.0/SRPMS/xli-1.17.0-8.2.20060mdk.src.rpm

  Mandrivalinux 2006.0/X86_64:
  697bdbad88bdc84815edd227c634911f  x86_64/2006.0/RPMS/xli-1.17.0-8.2.20060mdk.x86_64.rpm
  fc2ef038f442fd1a47f3dad7d1761b7e  x86_64/2006.0/SRPMS/xli-1.17.0-8.2.20060mdk.src.rpm

  Corporate Server 2.1:
  f241a38c8afb0562d8f1a2a185b2a0b4  corporate/2.1/RPMS/xli-1.17.0-4.2.C21mdk.i586.rpm
  795a9753cbd18799da32860f40e280c6  corporate/2.1/SRPMS/xli-1.17.0-4.2.C21mdk.src.rpm

  Corporate Server 2.1/X86_64:
  7434ac7065215eac6b1e1797fcb16bad  x86_64/corporate/2.1/RPMS/xli-1.17.0-4.2.C21mdk.x86_64.rpm
  795a9753cbd18799da32860f40e280c6  x86_64/corporate/2.1/SRPMS/xli-1.17.0-4.2.C21mdk.src.rpm

  Corporate 3.0:
  8d9782019acde544f2b601f2cf030302  corporate/3.0/RPMS/xli-1.17.0-8.3.C30mdk.i586.rpm
  0ab7c839749985bf184f4a8aa45e9bd1  corporate/3.0/SRPMS/xli-1.17.0-8.3.C30mdk.src.rpm

  Corporate 3.0/X86_64:
  ebc5619b0dd31c2e45c4ee9b5a0eb48e  x86_64/corporate/3.0/RPMS/xli-1.17.0-8.3.C30mdk.x86_64.rpm
  0ab7c839749985bf184f4a8aa45e9bd1  x86_64/corporate/3.0/SRPMS/xli-1.17.0-8.3.C30mdk.src.rpm
  _______________________________________________________________________

  To upgrade automatically use MandrakeUpdate or urpmi.  The verification
  of md5 checksums and GPG signatures is performed automatically for you.

  All packages are signed by Mandriva for security.  You can obtain the
  GPG public key of the Mandriva Security Team by executing:

   gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

  You can view other update advisories for Mandriva Linux at:

   http://www.mandriva.com/security/advisories

  If you want to report vulnerabilities, please contact

   security_(at)_mandriva.com
  _______________________________________________________________________

  Type Bits/KeyID     Date       User ID
  pub  1024D/22458A98 2000-07-10 Mandriva Security Team
   <security*mandriva.com>

======================================================================

         =========================================================
         Les serveurs de référence du CERT-Renater
         http://www.urec.fr/securite
         http://www.cru.fr/securite
         http://www.renater.fr
         =========================================================
         + CERT-RENATER          | tel : 01-53-94-20-44          +
         + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
         + 75013 Paris           | email: certsvp@renater.fr     +
         =========================================================